91 lines
2.1 KiB
Diff
91 lines
2.1 KiB
Diff
|
---------------------
|
||
|
|
PatchSet 2876
|
||
|
|
Date: 2014/12/29 14:09:11
|
||
|
|
Author: erouault
|
||
|
|
Branch: HEAD
|
||
|
|
Tag: (none)
|
||
|
|
Log:
|
||
|
|
* libtiff/tif_next.c: add new tests to check that we don't read outside of
|
||
|
|
the compressed input stream buffer.
|
||
|
|
|
||
|
|
* libtiff/tif_getimage.c: in OJPEG case, fix checks on strile width/height
|
||
|
|
|
||
|
|
Members:
|
||
|
|
ChangeLog:1.980->1.981
|
||
|
|
libtiff/tif_getimage.c:1.85->1.86
|
||
|
|
libtiff/tif_next.c:1.15->1.16
|
||
|
|
|
||
|
|
Index: libtiff/libtiff/tif_getimage.c
|
||
|
|
diff -u libtiff/libtiff/tif_getimage.c:1.85 libtiff/libtiff/tif_getimage.c:1.86
|
||
|
|
--- libtiff/libtiff/tif_getimage.c:1.85 Thu Dec 25 13:29:11 2014
|
||
|
|
+++ libtiff/libtiff/tif_getimage.c Mon Dec 29 07:09:11 2014
|
||
|
|
@@ -1871,7 +1871,7 @@
|
||
|
|
|
||
|
|
(void) y;
|
||
|
|
fromskew = (fromskew * 10) / 4;
|
||
|
|
- if ((h & 3) == 0 && (w & 1) == 0) {
|
||
|
|
+ if ((w & 3) == 0 && (h & 1) == 0) {
|
||
|
|
for (; h >= 2; h -= 2) {
|
||
|
|
x = w>>2;
|
||
|
|
do {
|
||
|
|
@@ -1948,7 +1948,7 @@
|
||
|
|
/* XXX adjust fromskew */
|
||
|
|
do {
|
||
|
|
x = w>>2;
|
||
|
|
- do {
|
||
|
|
+ while(x>0) {
|
||
|
|
int32 Cb = pp[4];
|
||
|
|
int32 Cr = pp[5];
|
||
|
|
|
||
|
|
@@ -1959,7 +1959,8 @@
|
||
|
|
|
||
|
|
cp += 4;
|
||
|
|
pp += 6;
|
||
|
|
- } while (--x);
|
||
|
|
+ x--;
|
||
|
|
+ }
|
||
|
|
|
||
|
|
if( (w&3) != 0 )
|
||
|
|
{
|
||
|
|
@@ -2050,7 +2051,7 @@
|
||
|
|
fromskew = (fromskew * 4) / 2;
|
||
|
|
do {
|
||
|
|
x = w>>1;
|
||
|
|
- do {
|
||
|
|
+ while(x>0) {
|
||
|
|
int32 Cb = pp[2];
|
||
|
|
int32 Cr = pp[3];
|
||
|
|
|
||
|
|
@@ -2059,7 +2060,8 @@
|
||
|
|
|
||
|
|
cp += 2;
|
||
|
|
pp += 4;
|
||
|
|
- } while (--x);
|
||
|
|
+ x --;
|
||
|
|
+ }
|
||
|
|
|
||
|
|
if( (w&1) != 0 )
|
||
|
|
{
|
||
|
|
Index: libtiff/libtiff/tif_next.c
|
||
|
|
diff -u libtiff/libtiff/tif_next.c:1.15 libtiff/libtiff/tif_next.c:1.16
|
||
|
|
--- libtiff/libtiff/tif_next.c:1.15 Sun Dec 21 13:07:48 2014
|
||
|
|
+++ libtiff/libtiff/tif_next.c Mon Dec 29 07:09:11 2014
|
||
|
|
@@ -71,7 +71,7 @@
|
||
|
|
TIFFErrorExt(tif->tif_clientdata, module, "Fractional scanlines cannot be read");
|
||
|
|
return (0);
|
||
|
|
}
|
||
|
|
- for (row = buf; occ > 0; occ -= scanline, row += scanline) {
|
||
|
|
+ for (row = buf; cc > 0 && occ > 0; occ -= scanline, row += scanline) {
|
||
|
|
n = *bp++, cc--;
|
||
|
|
switch (n) {
|
||
|
|
case LITERALROW:
|
||
|
|
@@ -90,6 +90,8 @@
|
||
|
|
* The scanline has a literal span that begins at some
|
||
|
|
* offset.
|
||
|
|
*/
|
||
|
|
+ if( cc < 4 )
|
||
|
|
+ goto bad;
|
||
|
|
off = (bp[0] * 256) + bp[1];
|
||
|
|
n = (bp[2] * 256) + bp[3];
|
||
|
|
if (cc < 4+n || off+n > scanline)
|